Forge Utah Foundation - Authentication Platform

A centralized authentication and authorization service for all Forge Utah Foundation applications, featuring Slack OAuth integration and comprehensive role-based access control.

Features

• Centralized Authentication Portal - Terminal-themed login page with Forge Utah branding
• Slack OAuth 2.0 - Secure authentication via Slack workspace
• Multi-Application Support - Single auth service for all Forge apps
• RBAC System - Role-based access control with 6 predefined roles
• JWT Tokens - Secure tokens with embedded roles and permissions
• Casbin Integration - Policy-based authorization engine
• TUI Test Client - Terminal interface for testing authentication

Setup

1. Create a Slack App

1. Go to api.slack.com/apps
2. Click "Create New App" → "From scratch"
3. Name your app (e.g., "Forge Auth") and select the Forge Utah workspace
4. Navigate to "OAuth & Permissions"
5. Add redirect URL: https://auth.forge.utah/callback (or http://localhost:3000/callback for development)
6. Add OAuth scopes under "User Token Scopes":
   • users:read - Read user profile
   • users:read.email - Access user email
   • team:read - Read workspace info
7. Save your Client ID and Client Secret

2. Configure Environment

cp .env.example .env

Edit .env with your configuration:

# Slack OAuth
SLACK_CLIENT_ID=your_slack_client_id
SLACK_CLIENT_SECRET=your_slack_client_secret
SLACK_REDIRECT_URI=http://localhost:3000/callback
SLACK_TEAM_ID=TC92KEFJT # Forge Utah workspace ID# JWT Configuration
JWT_SECRET=your-secret-key-change-in-production
JWT_EXPIRY_HOURS=24
# Server
PORT=3000
SERVER_URL=http://localhost:3000

3. Install and Run

# Install dependencies
go mod download
# Run the auth server
go run cmd/auth-server/main.go
# In another terminal, test with TUI client
go run cmd/test-tui/main.go

Quick Start

Visit http://localhost:3000 to see the authentication portal.

For API integration:

# Check permission
curl -X POST http://localhost:3000/auth/check \
-H "Content-Type: application/json" \
-d '{"token": "your-jwt", "resource": "meetups", "action": "create"}'# Get user roles
curl http://localhost:3000/auth/roles \
-H "Authorization: Bearer your-jwt"

RBAC Roles

Role	Description	Use Case
viewer	Read-only access (default)	New users, public visitors
verified	Can participate in community	Active community members
moderator	Content moderation	Community moderators
meetup_organizer	Create/manage events	Event organizers
admin	Organization management	Forge Utah staff
super_admin	Full system access	System administrators

Project Structure

forge-platform/
├── cmd/
│ ├── auth-server/ # Main authentication server
│ └── test-tui/ # Terminal UI test client
├── internal/auth/
│ ├── oauth_server.go # OAuth flow handling
│ ├── rbac_service.go # RBAC logic with Casbin
│ ├── rbac_store.go # Role/permission storage
│ ├── rbac_handlers.go # Authorization endpoints
│ ├── jwt.go # JWT token management
│ ├── slack.go # Slack API integration
│ ├── templates.go # HTML templates
│ └── tui_client.go # TUI authentication client
├── config/
│ ├── auth_model.conf # Casbin RBAC model
│ └── auth_policy.csv # Casbin policies
├── data/rbac/ # RBAC data storage
└── docs/
├── authentication.md # Complete auth documentation
├── api-reference.md # API endpoint reference
└── deployment.md # Production deployment guide

Documentation

• Authentication Guide - Complete authentication and RBAC documentation
• API Reference - Detailed API endpoint documentation
• Deployment Guide - Production deployment instructions

Libraries Used

• OAuth: golang.org/x/oauth2 - OAuth 2.0 client
• Slack API: slack-go/slack - Official Slack SDK
• Authorization: casbin/casbin/v2 - RBAC authorization
• JWT: golang-jwt/jwt/v5 - JWT tokens
• Router: gorilla/mux - HTTP routing
• Config: spf13/viper - Configuration management

Contributing

This is a Forge Utah Foundation project. For contributions, please:

1. Fork the repository
2. Create a feature branch
3. Submit a pull request

License

© 2024 Forge Utah Foundation. All rights reserved.